Security and Vulnerability Disclosure
Toutye security controls and the rules for reporting a suspected vulnerability safely.
Security program
Toutye uses tenant and environment isolation, least-privilege workload identities, encryption in transit and for protected data at rest, credential sealing, signed webhooks, malware scanning, append-only audit evidence, monitored queues and controllers, dependency review, immutable releases and a database backup before every release. An encrypted backup kept off the production server, with scheduled restore testing, is being introduced and is not yet in place. Controls are risk-based and evolve with the service. No system can guarantee absolute security.
Report a vulnerability
Email [email protected]with the affected URL or component, reproduction steps, impact, relevant timestamps and a safe contact method. Do not include live customer data, credentials or destructive payloads. Toutye will acknowledge a credible report, investigate, communicate status at reasonable intervals and coordinate remediation and disclosure where appropriate.
Authorized good-faith research
We will not pursue legal action solely for good-faith research that avoids privacy harm, service disruption and unlawful access; uses only accounts and data you own or have written permission to test; stops when sensitive data is encountered; reports promptly; preserves confidentiality while we remediate; and complies with applicable law. This is not authorization to test Meta, Cloudflare, Oracle, Stripe, Twilio or any other third party.
Out of scope
- Denial of service, load testing, spam, social engineering or physical attacks.
- Accessing, modifying, deleting or exfiltrating another customer's data.
- Automated scans that impair service or ignore rate limits.
- Extortion, public disclosure before remediation, or demands for payment.
- Provider issues that do not result from Toutye code or configuration.
Customer responsibilities
Customers must protect credentials, enable available MFA, restrict roles, review users and integrations, rotate exposed secrets, validate webhook signatures, maintain secure recipient systems, and notify Toutye promptly of suspected compromise. Security summaries may be requested under appropriate confidentiality terms.
Contact
Bagadi LLC operates Toutye. Legal questions: [email protected]. Privacy questions and rights requests: [email protected]. Toutye support questions: [email protected]. Do not email passwords, payment-card data, message content, or identity documents; Toutye will provide a secure verification channel when needed.